Skip to content

Commit 02fc62a

Browse files
dtapiacldtapiacl
committed
(openvpnas) openvpnas module install tests
1 parent b4acfd0 commit 02fc62a

File tree

5 files changed

+178
-0
lines changed

5 files changed

+178
-0
lines changed

‎Puppetfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ mod 'lsst/java_artisanal', '3.4.1'
3030
mod 'lsst/kubectl', '1.2.0'
3131
mod 'lsst/maven', '3.1.0'
3232
mod 'lsst/nm', '0.3.0'
33+
mod 'lsst/openvpnas', git: 'https://github.com/lsst-it/puppet-openvpnas', ref: '026a9c4'
3334
mod 'lsst/pi', '1.0.0'
3435
mod 'lsst/powertop', '0.1.2'
3536
mod 'lsst/rke', '2.1.0'

‎hieradata/role/openvpnas.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
classes:
3+
- "profile::core::common"
4+
- "profile::core::openvpnas"
5+
6+
profile::core::openvpnas::version: "3.0.1_84b60e70"

‎site/profile/manifests/core/openvpnas.pp‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# @summary
2+
# Installs OpenVPN Access Server and configures LDAP + default groups.
3+
#
4+
# @param version
5+
# Sets version lock for OpenVPN package.
6+
#
7+
# @param bind_pw
8+
# Optional. LDAP bind password for OpenVPN Access Server.
9+
#
10+
class profile::core::openvpnas (
11+
String[1] $version,
12+
Optional[String[1]] $bind_pw = undef,
13+
) {
14+
include profile::core::letsencrypt
15+
16+
# Host FQDN
17+
$fqdn = fact('networking.fqdn')
18+
19+
# Signed Certificate Location
20+
$le_root = "/etc/letsencrypt/live/${fqdn}"
21+
22+
$ldap_pw = pick($bind_pw, 'testpassword')
23+
24+
# Generate and sign certificate
25+
letsencrypt::certonly { $fqdn:
26+
plugin => 'dns-route53',
27+
manage_cron => true,
28+
}
29+
30+
# Configure OpenVPN Access Server
31+
class { 'openvpnas':
32+
manage_repo => true,
33+
version => $version,
34+
versionlock_enable => true,
35+
versionlock_release => '1.el9',
36+
manage_service => true,
37+
manage_web_certs => true,
38+
cert_source_path => $le_root,
39+
require => Letsencrypt::Certonly[$fqdn],
40+
41+
config => {
42+
# Define LDAP settings FIRST
43+
'auth.ldap.0.enable' => 'true',
44+
'auth.ldap.0.name' => 'Rubin LDAP Servers',
45+
'auth.ldap.0.server.0.host' => 'ipa1.cp.lsst.org',
46+
'auth.ldap.0.server.1.host' => 'ipa1.ls.lsst.org',
47+
'auth.ldap.0.bind_dn' => 'uid=svc_openvpnas,cn=users,cn=accounts,dc=lsst,dc=cloud',
48+
'auth.ldap.0.bind_pw' => $ldap_pw,
49+
'auth.ldap.0.users_base_dn' => 'cn=accounts,dc=lsst,dc=cloud',
50+
'auth.ldap.0.add_req' => 'memberOf=cn=vpn,cn=groups,cn=accounts,dc=lsst,dc=cloud',
51+
'auth.ldap.0.user_exists_check' => 'true',
52+
'auth.ldap.0.use_ssl' => 'never',
53+
'auth.ldap.0.ssl_verify' => 'internal',
54+
'auth.ldap.0.timeout' => '4',
55+
'auth.ldap.0.uname_attr' => 'uid',
56+
'auth.ldap.0.def_group' => 'vpn-default',
57+
'vpn.server.group_default' => 'vpn-default',
58+
'auth.local.0.enable' => 'false',
59+
},
60+
}
61+
62+
# Set the authentication module type AFTER LDAP servers are defined
63+
exec { 'set-auth-module-ldap':
64+
command => '/usr/local/openvpn_as/scripts/sacli -k auth.module.type -v ldap ConfigPut && /usr/local/openvpn_as/scripts/sacli start',
65+
path => ['/usr/local/openvpn_as/scripts', '/usr/bin', '/usr/local/bin'],
66+
unless => '/usr/local/openvpn_as/scripts/sacli ConfigQuery | grep -q \'"auth.module.type": "ldap"\'',
67+
require => Class['openvpnas'],
68+
}
69+
70+
# Create vpn-it and vpn-default groups
71+
exec { 'create_openvpn_groups':
72+
command => '/usr/local/openvpn_as/scripts/sacli --user vpn-it --key "type" --value "group" UserPropPut &&
73+
/usr/local/openvpn_as/scripts/sacli --user vpn-it --key "group_declare" --value "true" UserPropPut &&
74+
/usr/local/openvpn_as/scripts/sacli --user vpn-default --key "type" --value "group" UserPropPut &&
75+
/usr/local/openvpn_as/scripts/sacli --user vpn-default --key "group_declare" --value "true" UserPropPut &&
76+
/usr/local/openvpn_as/scripts/sacli start',
77+
path => ['/usr/local/openvpn_as/scripts', '/usr/bin', '/usr/local/bin'],
78+
unless => '/usr/local/openvpn_as/scripts/sacli UserPropGet | grep -q "vpn-default"',
79+
require => Exec['set-auth-module-ldap'],
80+
}
81+
82+
# Grant admin role to vpn-it
83+
exec { 'grant_admin_to_vpn_it':
84+
command => '/usr/local/openvpn_as/scripts/sacli --user vpn-it --key "prop_superuser" --value "true" UserPropPut && /usr/local/openvpn_as/scripts/sacli start',
85+
path => ['/usr/local/openvpn_as/scripts', '/usr/bin', '/usr/local/bin'],
86+
unless => '/usr/local/openvpn_as/scripts/sacli --pfilt vpn-it UserPropGet | grep -q "prop_superuser.*:.*true"',
87+
require => Exec['create_openvpn_groups'],
88+
}
89+
}

‎spec/classes/core/openvpnas_spec.rb‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'profile::core::openvpnas' do
6+
on_supported_os.each do |os, os_facts|
7+
# Only test AlmaLinux 9 for now
8+
next unless os =~ %r{almalinux-9-x86_64}
9+
10+
context "on #{os}" do
11+
let(:facts) do
12+
os_facts.merge(
13+
networking: {
14+
fqdn: 'foo.example.com',
15+
}
16+
)
17+
end
18+
19+
let(:fqdn) { facts[:networking][:fqdn] }
20+
let(:le_root) { "/etc/letsencrypt/live/#{fqdn}" }
21+
22+
context 'with default parameters' do
23+
let(:params) do
24+
{
25+
version: '3.0.1_84b60e70',
26+
}
27+
end
28+
29+
it { is_expected.to compile.with_all_deps }
30+
31+
it do
32+
is_expected.to contain_letsencrypt__certonly(fqdn).with(
33+
plugin: 'dns-route53',
34+
manage_cron: true
35+
)
36+
end
37+
38+
it do
39+
is_expected.to contain_class('openvpnas').with(
40+
manage_repo: true,
41+
version: '3.0.1_84b60e70',
42+
versionlock_enable: true,
43+
versionlock_release: '1.el9',
44+
manage_service: true,
45+
manage_web_certs: true,
46+
cert_source_path: le_root,
47+
require: "Letsencrypt::Certonly[#{fqdn}]"
48+
)
49+
end
50+
end
51+
end
52+
end
53+
end

‎spec/hosts/roles/openvpnas_spec.rb‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
role = 'openvpnas'
6+
7+
describe "#{role} role" do
8+
on_supported_os.each do |os, os_facts|
9+
next unless os =~ %r{almalinux-9-x86_64}
10+
11+
context "on #{os}" do
12+
lsst_sites.each do |site|
13+
describe "#{role}.#{site}.lsst.org", :sitepp do
14+
let(:node_params) do
15+
{
16+
role:,
17+
site:,
18+
}
19+
end
20+
let(:facts) { lsst_override_facts(os_facts) }
21+
22+
it { is_expected.to compile.with_all_deps }
23+
24+
include_examples('common', os_facts:, site:)
25+
end # host
26+
end # lsst_sites
27+
end # on os
28+
end # on_supported_os
29+
end # role

0 commit comments

Comments
 (0)